feat(server): add POST /attachment/location mirroring product shelving

Co-Authored-By: Claude <noreply@anthropic.com>

tests/test_attachment_api.py

@@ -194,3 +194,103 @@ def test_config_rejects_unknown_category(client: TestClient):
     )
     assert resp.status_code == 404
     assert resp.json()["error_code"] == "CATEGORY_NOT_FOUND"
+
+
+def _config_one_type(client: TestClient, cert_id: int):
+    client.put(
+        "/CargoTrace/attachment/config",
+        json={
+            "zongpai_no": "26BW0011",
+            "determination": "has",
+            "items": [{"category_id": cert_id, "expected_qty": 80}],
+        },
+    )
+
+
+def test_attachment_location_create_and_duplicate(client: TestClient, db: Session):
+    cert_id = _seed_categories(db)[0]
+    _config_one_type(client, cert_id)
+
+    created = client.post(
+        "/CargoTrace/attachment/location",
+        json={
+            "zongpai_no": "26BW0011",
+            "category_id": cert_id,
+            "location_code": "A01-01-01",
+        },
+    )
+    assert created.status_code == 200
+    assert created.json()["location_code"] == "A01-01-01"
+    assert created.json()["previous_location"] is None
+
+    dup = client.post(
+        "/CargoTrace/attachment/location",
+        json={
+            "zongpai_no": "26BW0011",
+            "category_id": cert_id,
+            "location_code": "A02-02-02",
+        },
+    )
+    assert dup.status_code == 409
+    assert dup.json()["error_code"] == "DUPLICATE_LOCATION"
+
+
+def test_attachment_location_normal_to_temp_then_transit(client: TestClient, db: Session):
+    cert_id = _seed_categories(db)[0]
+    _config_one_type(client, cert_id)
+
+    client.post(
+        "/CargoTrace/attachment/location",
+        json={
+            "zongpai_no": "26BW0011",
+            "category_id": cert_id,
+            "location_code": "A01-01-01",
+        },
+    )
+    # normal -> temp storage (B prefix) allowed
+    to_temp = client.post(
+        "/CargoTrace/attachment/location",
+        json={
+            "zongpai_no": "26BW0011",
+            "category_id": cert_id,
+            "location_code": "B01-01-01",
+        },
+    )
+    assert to_temp.status_code == 200
+    assert to_temp.json()["previous_location"] == "A01-01-01"
+
+    # -> transit (terminal)
+    to_transit = client.post(
+        "/CargoTrace/attachment/location",
+        json={
+            "zongpai_no": "26BW0011",
+            "category_id": cert_id,
+            "location_code": "TRANS-001",
+        },
+    )
+    assert to_transit.status_code == 200
+
+    # already transit -> any op blocked
+    again = client.post(
+        "/CargoTrace/attachment/location",
+        json={
+            "zongpai_no": "26BW0011",
+            "category_id": cert_id,
+            "location_code": "A03-03-03",
+        },
+    )
+    assert again.status_code == 409
+    assert again.json()["error_code"] == "ALREADY_OFF_SHELF"
+
+
+def test_attachment_location_rejects_unknown_category(client: TestClient):
+    resp = client.post(
+        "/CargoTrace/attachment/location",
+        json={
+            "zongpai_no": "26BW0011",
+            "category_id": 9999999,
+            "location_code": "A01-01-01",
+        },
+    )
+    assert resp.status_code == 404
+    assert resp.json()["error_code"] == "CATEGORY_NOT_FOUND"